提交 #887138: boxpositron with-context-mcp 3.0.7 Path Traversal

The boxpositron/with-context-mcp MCP server exposes note synchronization tools such as teleport_notes and sync_notes for moving files between an Obsidian vault and a local project directory. Although the core note tools validate direct user-supplied note paths, the synchronization flow uses file paths derived from vault file listings and joins them with the local project root before writing to the local filesystem.

In a local reproduction, the Obsidian REST API was mocked to return a vault file entry containing a traversal path, ../outside-poc/teleported.md. The teleport_notes tool was then invoked with dry_run set to false. The server read the mocked vault file content and wrote it to ../outside-poc/teleported.md, outside the repository directory. The resulting file contained the marker VAULT_TO_LOCAL_ESCAPE_MARKER_123456, confirming that the synchronization path can escape the intended project boundary.

This demonstrates a workspace escape / arbitrary file write issue in the note teleport/synchronization path. Depending on deployment configuration and the trust boundary of the vault or Obsidian API responses, an attacker able to influence vault file names or synchronization inputs may cause the MCP server process to write files outside the intended project directory. Related read and delete impacts should be evaluated separately through the ingest/sync flows.

• 来源: ⚠️ http://github.com/boxpositron/with-context-mcp/issues/2
• 用户: cccccccti (UID 96695)
• 提交: 2026-07-12 17時30分 (2 月前)
• 管理: 2026-08-26 22時55分 (2 months later)
• 状态: 已接受
• VulDB条目: 395981 [boxpositron with-context-mcp 直到 3.0.7 src/index.ts 目录遍历]
• 积分: 20